API Enumeration & Documentation Discovery
Discover and map REST, GraphQL, and WebSocket APIs — find undocumented endpoints, authentication schemes, rate limits, and data schemas.
Tools
Machine-readable JSON available at:
https://reconatlas.pages.dev/api/checklists/api-enumerationTags
// checklist steps
apienum-01
Discover Swagger and OpenAPI documentation
Probe common paths for exposed API documentation files that reveal every endpoint, parameter, and data model.
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api/api-docs.txt -mc 200 -o api-docs-fuzz.json
curl -sk https://target.com/swagger.json | jq '.paths | keys'
curl -sk https://target.com/api-docs
curl -sk https://target.com/openapi.json | jq '.paths | keys'
nuclei -u https://target.com -t exposures/apis/ -o api-docs-found.txtCheck for documentation at /swagger.json, /swagger-ui.html, /api-docs, /openapi.json, /v2/api-docs, and /v3/api-docs. Even when the UI is disabled, the JSON spec is often still served.
apienum-02
Scan for GraphQL introspection
Test for enabled GraphQL introspection to extract the full API schema including types, queries, mutations, and field definitions.
curl -sk -X POST https://target.com/graphql -H 'Content-Type: application/json' -d '{"query":"{__schema{types{name,fields{name,args{name,type{name}}}}}}"}
curl -sk -X POST https://target.com/api/graphql -H 'Content-Type: application/json' -d '{"query":"query{__schema{queryType{fields{name description}}}}"}
nuclei -u https://target.com -t technologies/graphql-detect.yaml -o graphql-found.txtIf introspection is disabled, try field suggestion attacks — send partial queries and observe error messages that leak field names.
apienum-03
Discover WADL and WSDL service descriptions
Check for SOAP and legacy REST service descriptions that expose operations, data types, and endpoint bindings.
curl -sk https://target.com/application.wadl
curl -sk 'https://target.com/ws/service?wsdl'
ffuf -u 'https://target.com/FUZZ' -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt -mc 200 -o wadl-wsdl.json
curl -sk https://target.com/services/ | grep -iE '(wsdl|wadl|asmx|svc)'WSDL files are common in enterprise environments running Java and .NET backends. They fully describe the service contract — treat them as complete API documentation.
apienum-04
Enumerate API versioning and deprecated endpoints
Map all API versions to find deprecated endpoints that may lack current security controls.
ffuf -u 'https://target.com/api/FUZZ/users' -w <(seq 1 20 | sed 's/^/v/') -mc 200,301,403 -o api-versions.json
curl -sk https://target.com/api/v1/users -o /dev/null -w '%{http_code}'
curl -sk https://target.com/api/v2/users -o /dev/null -w '%{http_code}'
curl -sk -H 'Accept: application/vnd.target.v1+json' https://target.com/api/usersDeprecated API versions often lack rate limiting, input validation, and authorisation checks that were added in newer versions. Always test the oldest available version.
apienum-05
Test rate limiting and throttling
Determine rate limit thresholds on API endpoints to identify brute-force opportunities and denial of service risks.
for i in $(seq 1 100); do curl -sk -o /dev/null -w '%{http_code} ' https://target.com/api/users; done
ffuf -u https://target.com/api/login -X POST -d 'user=admin&pass=FUZZ' -w /usr/share/wordlists/rockyou.txt -mc 200 -rate 10
curl -sk -I https://target.com/api/users | grep -iE '(x-rate|x-ratelimit|retry-after)'Check for rate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After). Test whether limits are per-IP, per-user, or per-session — each has different bypass strategies.
apienum-06
Identify authentication schemes
Map authentication mechanisms across all API endpoints to find inconsistencies and bypass opportunities.
curl -sk -I https://target.com/api/users | grep -iE '(www-authenticate|authorization|x-api-key)'
curl -sk https://target.com/api/users -H 'Authorization: Bearer invalid' -o /dev/null -w '%{http_code}'
curl -sk https://target.com/api/users -o /dev/null -w '%{http_code}'
nuclei -u https://target.com -t misconfiguration/unauthenticated-api.yaml -o unauth-api.txtCompare responses between authenticated and unauthenticated requests. Test for authentication bypass by removing the Authorization header, using an expired token, or swapping between authentication methods.
apienum-07
Discover Postman collections and API artefacts
Search for publicly exposed Postman collections, Insomnia exports, and other API testing artefacts that reveal full endpoint inventories.
curl -sk https://target.com/postman_collection.json
curl -sk https://target.com/.postman/collection.json
gau target.com | grep -iE '(postman|insomnia|collection\.json|workspace)'
nuclei -u https://target.com -t exposures/apis/postman-collection.yamlPublic Postman workspaces are searchable at postman.com. Search for the target's domain name to find collections shared by their developers.
Overview
APIs are the backbone of modern web applications and frequently the weakest link in security. Thorough API enumeration reveals the full contract between client and server, exposing endpoints, parameters, and authentication requirements that are invisible through standard web browsing.
Discovery strategy
Layer these approaches for comprehensive API mapping:
- Documentation hunting — find Swagger, OpenAPI, WADL, and WSDL files
- Schema extraction — use GraphQL introspection and error-based enumeration
- Version mapping — enumerate all API versions, especially deprecated ones
- Artefact discovery — search for Postman collections and developer exports
Critical findings
- GraphQL introspection enabled on production (full schema leak)
- Swagger UI exposed with “Try it out” functionality on sensitive endpoints
- Deprecated API versions without authentication or authorisation
- Missing rate limiting on authentication and data export endpoints
- Inconsistent authentication requirements across API versions